US5719938A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Methods for providing secure access to shared information
Assignee: Nokia of America Corp
•
Filing: 1994-08-01
•
Granted: 1998-02-17
•
Expires: 2014-08-01
Abstract
Abstract The inventive methods employ symmetric encryption with first and second keys to provide secure access to information accessible to be shared among a dynamically changing set of authorized users on a network having a server. A single copy of the information, encrypted with the first key of the server, is stored in a location accessible to all network users. The second key is a private key of an authorized user and is used by the server to encrypt the first key. The encrypted first key is then stored by the server at a storage location accessible by the authorized user. The user accesses the storage location, obtains the encrypted first key, and uses his private second key to decrypt and thereby recover the first key. The user then decrypts the stored information using the recovered first key.
Inventors
- 👤 Zygmunt Haas
- 👤 Sanjoy Paul
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 11:45
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/06; H04L63/062; H04L63/10; H04L9/00; H04L9/08; H04L9/0891; H04L9/0894
Claims Analysis
Total Claims: 19
Claim 1
Independent Claim
264 words
A method of controlling access to electronically-defined information among a plurality of users connected to a network having a server operable for assuring that the electronically-defined information is accessible by only at least a predetermined one of the plural users, each of said plural users having a unique first encryption key having a first portion and a second portion, said method comprising the steps of: making said first portion known to both the server and said predetermined user; making said second portion known only to the server; encrypting the electronically-defined information using a second encryption key known only to the server to define encrypted information; storing the encrypted information in network-associated electronic storage accessible through the network to said plurality of users; encrypting the second encryption key using the first encryption key of the predetermined user to which access to the electronically-defined information is to be provided so as to define an encrypted second key; storing the encrypted second key in an electronic storage location accessible by said predetermine user; and attaining access by the predetermined user to the unencrypted electronically-defined information by: accessing the stored encrypted second key from a network-connected apparatus of the predetermined user; decrypting the accessed encrypted second key using the first key of the predetermined user at the apparatus of the predetermined user to recover the second encryption key; accessing the stored encrypted information from the network-connected apparatus of the predetermined user; and decrypting the accessed encrypted information using the recovered second encryption key to recover the electrically-defined information for examination of the recovered information by the predetermined user.
Claim 2
Independent Claim
264 words
A method of controlling access to electronically-defined information among a plurality of users connected to a network having a server operable for assuring that the electronically-defined information is accessible by only at least a predetermined one of the plural users, each of said plural users having a unique first encryption key having a first portion and a second portion, said method comprising the steps of: making said first portion known to both the server and said predetermined user; making said second portion known only to the server; encrypting the electronically-defined information using a second encryption key known only to the server to define encrypted information; storing the encrypted information in network-associated electronic storage accessible through the network to said plurality of users; encrypting the second encryption key using the first encryption key of the predetermined user to which access to the electronically-defined information is to be provided so as to define an encrypted second key; storing the encrypted second key in an electronic storage location accessible by said predetermine user; and attaining access by the predetermined user to the unencrypted electronically-defined information by: accessing the stored encrypted second key from a network-connected apparatus of the predetermined user; decrypting the accessed encrypted second key using the first key of the predetermined user at the apparatus of the predetermined user to recover the second encryption key; accessing the stored encrypted information from the network-connected apparatus of the predetermined user; and decrypting the accessed encrypted information using the recovered second encryption key to recover the electrically-defined information for examination of the recovered information by the predetermined user.
Claim 3
Dependent Claim
20 words
A method in accordance with claim 1, further comprising the step of generating the second encryption key at the server.
Claim 4
Dependent Claim
97 words
A method in accordance with claim 1, further comprising the steps of: periodically generating a new second encryption key to replace a then-current second encryption key; and each time that a new second encryption key is generated, encrypting the new second encryption key using the first encryption key of the predetermined user so as to define a new encrypted second key; and storing the new encrypted second key in the electronic storage location accessible by the predetermined user to replace the encrypted second key previously stored in the electronic storage location for access by the predetermined user.
Claim 5
Dependent Claim
62 words
A method in accordance with claim 3 and further comprising, each time that a new second encryption key is generated, the steps of: encrypting the electronically-defined information using the new second encryption key to define newly-encrypted information; and storing the newly-encrypted information in the network-associated electronic storage accessible through the network to said plurality of users to replace the previously-stored encrypted information.
Claim 6
Dependent Claim
33 words
A method in accordance with claim 1, wherein said step of storing the encrypted second key comprises storing the encrypted second key in an electronic storage location accessible only by the predetermined user.
Claim 7
Dependent Claim
27 words
A method in accordance with claim 1, wherein said step of storing the encrypted information comprises storing the encrypted information in electronic storage associated with the server.
Claim 8
Dependent Claim
89 words
A method in accordance with claim 1, wherein said steps of accessing the stored encrypted second key, decrypting the accessed encrypted second key to recover the second encryption key, and decrypting the accessed encrypted information using the recovered second encryption key being carried out by operation of an executable program routine so as to restrict direct access by the predetermined user to the recovered second encryption key and thereby prevent unintended access to the recovered second encryption key by ones of said plural users other than the predetermined user.
Claim 9
Dependent Claim
96 words
A method in accordance with claim 1, wherein said steps of accessing the stored encrypted second key, decrypting the accessed encrypted second key to recover the second encryption key, and decrypting the accessed encrypted information using the recovered second encryption key being carried out by operation of an executable program routine at the apparatus of the predetermined user so as to restrict direct access by the predetermined user to the recovered second encryption key and thereby prevent unintended access to the recovered second encryption key by ones of said plural users other than the predetermined user.
Claim 10
Dependent Claim
36 words
A method in accordance with claim 1, where in said step of storing the encrypted second key comprises storing the encrypted second key in an electronic storage location associated with the apparatus of the predetermined user.
Claim 11
Dependent Claim
55 words
A method in accordance with claim 1, wherein said step of encrypting the electronically-defined information comprises dividing the information into a multiplicity of information portions and separately encrypting each of the multiplicity of information portions to define encrypted information comprising a multiplicity of separately-encrypted portions each individually accessible by predetermined ones of said plural users.
Claim 12
Independent Claim
230 words
A method of controlling access to electrically defined information among a plurality of users connected to a network having a server operable for assuring that the electronically defined information is accessible by only at least a predetermined one of the plural users, each of said plural users having a unique first encryption key having a first portion and a second portion, said method comprising the steps of: making said first portion known to both the server and said predetermined user; making said second portion known only to the sever; storing electronically defined information, encrypted using a second encryption key known only to the server, in network-associated electronic storage accessible through the network to said plurality of users; and attaining access, by a predetermined one of the plural users, to the unencrypted electronically defined information by: accessing the network from a network-connected apparatus of the predetermined user to further access the second key encrypted using the first encryption key of the predetermined user; decrypting the accessed encrypted second key using the first key of the predetermined user at the apparatus of the predetermined user to recover the second encryption key; accessing the stored encrypted information from the network-connected apparatus of the predetermined user; and decrypting the accessed encrypted information using the recovered second encryption key to recover the electronically defined information for examination of the recovered information by the predetermined user.
Claim 13
Independent Claim
230 words
A method of controlling access to electrically defined information among a plurality of users connected to a network having a server operable for assuring that the electronically defined information is accessible by only at least a predetermined one of the plural users, each of said plural users having a unique first encryption key having a first portion and a second portion, said method comprising the steps of: making said first portion known to both the server and said predetermined user; making said second portion known only to the sever; storing electronically defined information, encrypted using a second encryption key known only to the server, in network-associated electronic storage accessible through the network to said plurality of users; and attaining access, by a predetermined one of the plural users, to the unencrypted electronically defined information by: accessing the network from a network-connected apparatus of the predetermined user to further access the second key encrypted using the first encryption key of the predetermined user; decrypting the accessed encrypted second key using the first key of the predetermined user at the apparatus of the predetermined user to recover the second encryption key; accessing the stored encrypted information from the network-connected apparatus of the predetermined user; and decrypting the accessed encrypted information using the recovered second encryption key to recover the electronically defined information for examination of the recovered information by the predetermined user.
Claim 14
Dependent Claim
51 words
The method of claim 11, wherein said storing step includes the steps of: encrypting the electronically defined information using the second encryption key known only to the server to define the encrypted information; and storing the encrypted information in network-associated electronic storage accessible through the network to said plurality of users.
Claim 15
Dependent Claim
70 words
The method of claim 11 wherein, prior to the second key decrypting step, the method further includes the steps of: encrypting the second encryption key using the first encryption key of the predetermined user to which access to the electronically defined information is to be provided so as to define the encrypted second key; and storing the encrypted second key in an electronic storage location accessible by said predetermined user.
Claim 16
Dependent Claim
64 words
The method according to claim 1, further comprising the steps of: obtaining a credit card number from said predetermined user; and causing said credit card number to be communicated to said predetermined user during said step of decrypting the accessed encrypted information so as to discourage said predetermined user from sharing the first encryption key with a user to whom access is not permitted.
Claim 17
Dependent Claim
102 words
The method according to claim 1, further comprising: (a) assigning a unique network address to the network connected apparatus of said predetermined user; (b) determining, during the step of accessing the stored encrypted information, the unique network address of the network connected apparatus from which access to the encrypted information is being sought; (c) determining if the unique network address determined in said step (b) matches the unique network address assigned, to the network connected apparatus of the predetermined user; and (d) preventing the step of decrypting the accessed encrypted information from occurring if no match is found in said step (c).
Claim 18
Dependent Claim
64 words
The method according to claim 11, further comprising the steps of: obtaining a credit card number from said predetermined user; and causing said credit card number to be communicated to said predetermined user during said step of decrypting the accessed encrypted information so as to discourage said predetermined user from sharing the first encryption key with a user to whom access is not permitted.
Claim 19
Dependent Claim
102 words
The method according to claim 11, further comprising: (a) assigning a unique network address to the network connected apparatus of said predetermined user; (b) determining, during the step of accessing the stored encrypted information, the unique network address of the network connected apparatus from which access to the encrypted information is being sought; (c) determining if the unique network address determined in said step (b) matches the unique network address assigned to the network connected apparatus of the predetermined user; and (d) preventing the step of decrypting the accessed encrypted information from occurring if no match is found in said step (c).
References Cited (Backward Citations)
US5010571A
Cited
US5247575A
Cited
US5267313A
Cited
JPH06197105A
Cited
US5319705A
Cited
US5349642A
Cited
US5509074A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-02-16 | 2001-08-18 | 2002-02-17 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-02-16 | 2005-08-18 | 2006-02-17 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-02-16 | 2009-08-18 | 2010-02-17 | $7700.00 | Window Closed / Lapsed |